policy-platforms

name

policy-platforms

description

This skill should be used when the user asks about "kubernetes policy", "gatekeeper", "constraint template", "terraform policy", "conftest", "terraform compliance", "docker policy", "dockerfile policy", "envoy authz", "envoy authorization", "service mesh policy", "cloud policy", "aws policy rego", "azure policy rego", "gcp policy rego", or mentions writing OPA policies for a specific platform. Provides platform-specific Rego patterns and input schemas.

Policy Platforms

Platform-specific OPA/Rego patterns covering Kubernetes, Terraform, Docker, cloud providers, and service mesh. Each platform has unique input schemas and conventions.

Platform Quick Reference

Platform	Input Source	Policy Tool	Key Package
Kubernetes	AdmissionReview	Gatekeeper / OPA	kubernetes.admission
Terraform	Plan JSON	Conftest / OPA	terraform.analysis
Docker	Dockerfile AST	Conftest	main (Conftest convention)
Envoy	CheckRequest	OPA-Envoy plugin	envoy.authz
AWS/Azure/GCP	Terraform plan / CloudFormation	Conftest / Regula / Terrascan	Varies

---

Kubernetes (Gatekeeper)

Input Schema

Gatekeeper provides an AdmissionReview object:

{
  "review": {
    "object": { /* resource being created/updated */ },
    "oldObject": { /* previous version on UPDATE */ },
    "operation": "CREATE",
    "userInfo": { "username": "admin", "groups": ["system:masters"] },
    "namespace": "default"
  },
  "parameters": { /* constraint parameters */ }
}

ConstraintTemplate Pattern

package k8srequiredlabels

import rego.v1

violation contains {"msg": msg, "details": {"missing_labels": missing}} if {
    provided := {label | some label, _ in input.review.object.metadata.labels}
    required := {label | some label in input.parameters.labels}
    missing := required - provided
    count(missing) > 0
    msg := sprintf("missing required labels: %v", [missing])
}

Common K8s Policy Categories

Category	Examples
Pod Security	No privileged, runAsNonRoot, drop capabilities, read-only rootfs
Resource Limits	CPU/memory limits required, ratio constraints
Image Policy	Allowed registries, no latest tag, signed images
Network	NetworkPolicy required, no hostNetwork, port restrictions
Labels/Annotations	Required labels, label format validation
RBAC	No wildcard permissions, namespace isolation

Testing Gatekeeper Policies Locally

# Install gator CLI
go install github.com/open-policy-agent/gatekeeper/v3/cmd/gator@latest

# Test constraint template
gator verify suite.yaml

# Verify against test resources
gator test -f constraint-template.yaml -f constraint.yaml -f test-resource.yaml

---

Terraform

Input Schema

Terraform plan JSON (via terraform show -json tfplan):

{
  "resource_changes": [
    {
      "address": "aws_s3_bucket.example",
      "type": "aws_s3_bucket",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": ["create"],
        "before": null,
        "after": { /* planned state */ },
        "after_unknown": { /* computed values */ }
      }
    }
  ],
  "configuration": { /* HCL configuration tree */ },
  "planned_values": { /* root_module with resources */ }
}

Conftest Policy Pattern

package terraform.aws.s3

import rego.v1

deny contains msg if {
    some rc in input.resource_changes
    rc.type == "aws_s3_bucket"
    "create" in rc.change.actions
    not rc.change.after.server_side_encryption_configuration
    msg := sprintf("S3 bucket '%s' must have encryption enabled", [rc.address])
}

deny contains msg if {
    some rc in input.resource_changes
    rc.type == "aws_s3_bucket"
    rc.change.after.acl == "public-read"
    msg := sprintf("S3 bucket '%s' must not be public", [rc.address])
}

Workflow

# Generate plan JSON
terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json

# Evaluate with Conftest
conftest test tfplan.json -p policy/terraform/

# Evaluate with OPA directly
opa eval -d policy/terraform/ -i tfplan.json "data.terraform.aws.s3.deny"

Common Terraform Policy Categories

Category	Examples
Encryption	S3 SSE, RDS encryption, EBS encryption
Networking	No public IPs, security group restrictions, VPC required
IAM	No wildcard actions, MFA required, role boundaries
Tagging	Required tags (env, team, cost-center)
Compliance	Logging enabled, backup configured, deletion protection

---

Docker

Input Schema

Conftest parses Dockerfiles into structured commands:

{
  "Stages": [
    {
      "Name": "builder",
      "From": {"Image": "golang", "Tag": "1.22"},
      "Commands": [
        {"Cmd": "run", "Value": ["apt-get install -y curl"]},
        {"Cmd": "copy", "Value": [".", "/app"]},
        {"Cmd": "user", "Value": ["nonroot"]}
      ]
    }
  ]
}

Dockerfile Policy Pattern

package docker.security

import rego.v1

deny contains msg if {
    some stage in input.Stages
    stage.From.Tag == "latest"
    msg := sprintf("stage '%s' uses 'latest' tag - pin to specific version", [stage.Name])
}

deny contains msg if {
    some stage in input.Stages
    not _has_user(stage)
    msg := sprintf("stage '%s' missing USER instruction - must not run as root", [stage.Name])
}

warn contains msg if {
    some stage in input.Stages
    some cmd in stage.Commands
    cmd.Cmd == "add"
    msg := "prefer COPY over ADD unless extracting archives"
}

_has_user(stage) if {
    some cmd in stage.Commands
    cmd.Cmd == "user"
}

Workflow

conftest test Dockerfile -p policy/docker/

---

Envoy / Service Mesh

Input Schema

OPA-Envoy external authorization request:

{
  "attributes": {
    "request": {
      "http": {
        "method": "GET",
        "path": "/api/v1/users",
        "headers": {
          "authorization": "Bearer eyJ..."
        }
      }
    },
    "source": {
      "principal": "spiffe://cluster.local/ns/default/sa/frontend"
    },
    "destination": {
      "principal": "spiffe://cluster.local/ns/default/sa/backend"
    }
  }
}

Envoy Authorization Pattern

package envoy.authz

import rego.v1

default allow := false

allow if {
    input.attributes.request.http.method == "GET"
    glob.match("/api/v1/public/*", ["/"], input.attributes.request.http.path)
}

allow if {
    input.attributes.request.http.method in {"GET", "POST"}
    token := io.jwt.decode(bearer_token)
    "admin" in token[1].roles
}

bearer_token := t if {
    auth_header := input.attributes.request.http.headers.authorization
    startswith(auth_header, "Bearer ")
    t := substring(auth_header, 7, -1)
}

---

Cloud Provider Patterns

AWS (Terraform)

Common AWS resource types and their security properties:

Resource	Security Properties
aws_s3_bucket	server_side_encryption_configuration, acl, versioning, logging
aws_security_group	ingress[].cidr_blocks (no 0.0.0.0/0 on sensitive ports)
aws_rds_instance	storage_encrypted, backup_retention_period, deletion_protection
aws_iam_policy	No * in Action or Resource
aws_cloudtrail	enable_logging, is_multi_region_trail

Azure (Terraform)

Resource	Security Properties
azurerm_storage_account	enable_https_traffic_only, min_tls_version, network_rules
azurerm_key_vault	purge_protection_enabled, soft_delete_retention_days
azurerm_sql_server	administrator_login, minimum_tls_version

GCP (Terraform)

Resource	Security Properties
google_storage_bucket	uniform_bucket_level_access, encryption
google_compute_firewall	source_ranges (no 0.0.0.0/0)
google_sql_database_instance	settings.ip_configuration.require_ssl

---

Common Mistakes -- DO NOT MAKE THESE

These are the most frequent platform-specific errors. Check every policy against this table before finalizing.

Kubernetes / Gatekeeper

WRONG	CORRECT	Why
input.spec.containers	input.review.object.spec.containers	Gatekeeper wraps the resource under input.review.object
deny contains msg if	violation contains {"msg": msg} if	Gatekeeper uses violation returning objects, not deny returning strings
input.labels	input.review.object.metadata.labels	Labels are nested under the full K8s object path
Checking only containers	Also check initContainers	Init containers can also have security issues
input.spec.template.spec.containers (for Deployments)	Check input.review.object.spec.template.spec.containers	Workload controllers nest pod spec under .spec.template.spec

Terraform

WRONG	CORRECT	Why
input.resources	input.resource_changes	resources does not exist in plan JSON; use resource_changes
input.planned_values.resources	input.planned_values.root_module.resources	Missing root_module intermediate key
rc.after.bucket	rc.change.after.bucket	Planned values are under rc.change.after, not rc.after
Not checking rc.change.actions	Filter by "create" in rc.change.actions	Policies should only enforce on relevant actions (create/update)

Docker / Conftest

WRONG	CORRECT	Why
input.commands	input.Stages[].Commands[]	Docker AST nests commands under Stages; fields are PascalCase
cmd == "ADD"	cmd.Cmd == "add"	Commands are objects with .Cmd field; command type values are lowercase
input.from	input.Stages[].From.Image	Base image is nested under PascalCase From.Image per stage
Lowercase field names	PascalCase: Stages, Commands, Name, From, Cmd, Value	Conftest Dockerfile parser uses PascalCase for all struct fields

Envoy

WRONG	CORRECT	Why
input.request.method	input.attributes.request.http.method	Envoy nests HTTP details under attributes.request.http
input.headers	input.attributes.request.http.headers	Headers are deeply nested

---

Additional Resources

Reference Files

• references/kubernetes-input.md - Complete K8s AdmissionReview schema, Gatekeeper ConstraintTemplate authoring, gator testing
• references/terraform-input.md - Full Terraform plan JSON schema, resource_changes structure, configuration tree navigation
• references/cloud-resources.md - Comprehensive cloud resource security properties for AWS, Azure, GCP